- India Reportedly Working on New VPN Regulations
- Companies could be forced to establish an office in the country
- VPNs found a solution to previous restrictions
India is working on a sweeping new legal framework to clamp down on virtual private networks (VPNs), with proposals reportedly including mandatory local offices, designated compliance officers and even prison sentences for non-compliance.
According to The Indian Express, the upcoming rules aim to hold VPN providers legally responsible when citizens use their tools to bypass government-imposed content blocks.
“In recent months, we have observed that users are able to bypass online content, accounts and services that have been blocked by the government for various reasons by using VPN services,” an unnamed senior government official told reporters.
This new set of rules is also considered necessary, officials admitted, as the controversial data retention law enforced in 2022 by India’s Computer Emergency Response Team (CERT-In) proved unsuccessful.
The directive legally requires VPN companies, data centers and cloud providers to record sensitive user information (including real names, verified IP addresses and usage patterns) for up to five years and hand it over to authorities upon request.
However, major VPN companies, including ExpressVPN, NordVPN, Hide.me, Surfshark, and Proton VPN, found an easy way to avoid compliance: remove their physical servers from the country.
“They have simply refused to comply. Therefore, the need for a comprehensive law is felt,” the senior official told The Indian Express.
What’s at stake for Indian VPN users?
Beyond encrypting user data to increase privacy and security, virtual private networks (VPNs) spoof IP addresses, allowing users to bypass local geo-restrictions imposed by the state.
This capability has become critical for local Internet users. Last month, India saw a massive spike in VPN downloads after the government temporarily blocked messaging app Telegram over concerns about exam fraud.
Just weeks earlier, the Ministry of Electronics and Information Technology (MeitY) ordered VPN companies to actively block access to decentralized prediction platform Polymarket, threatening legal repercussions if they refused.
The proposed framework aims to give New Delhi the legal resources necessary to force VPN providers to enforce these content bans on behalf of the government. Digital rights groups frequently criticize India’s aggressive approach to censorship; According to data trackers, the country consistently leads the world in government-imposed internet shutdowns.
While specific details of the draft framework remain scarce, leaked proposals suggest that offshore VPN companies will need to establish a physical corporate presence in India and appoint local compliance officers to act as direct liaisons to the government.
Criminal penalties for non-compliance are also on the table, including possible prison sentences for local employees if an order is ignored.
However, serious questions remain about how authorities plan to enforce these rules. For many global VPN providers, simply keeping their physical servers outside Indian borders has been enough to bypass local jurisdiction.
Premium, strict no-logs services are also unlikely to fundamentally alter their server infrastructure to meet New Delhi’s demands, especially after resisting a similar ultimatum four years ago.
Dr. Pete Membrey, director of research at ExpressVPN, recalled the company’s decision in 2022 to become the first major provider to remove its physical servers from India, confirming that its stance remains.
“We will evaluate when a proposal is released,” Membrey told TechRadar, adding that “ExpressVPN will continue to work hard to keep users connected to the free, open Internet, no matter where they are.”
A Surfshark spokesperson also said the company remains committed to upholding the privacy of its users.
TechRadar has reached out to India’s Ministry of Electronics and Information Technology (MeitY) and CERT-In for further clarification on the draft framework and the expected implementation timeline. Neither agency responded before publication.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
